feat(gcpsm): auto-detect projectID from GCP metadata server by patjlm · Pull Request #5922 · external-secrets/external-secrets

patjlm · 2026-02-03T12:45:09Z

Problem Statement

When using Workload Identity in GKE, users must explicitly specify the projectID in SecretStore/ClusterSecretStore configurations, even when accessing secrets in the same GCP project as the GKE cluster. This forces per-cluster parameterization of SecretStore configs, preventing static GitOps deployments via Config Sync/Fleet in multi-project environments.

While PR #4575, #4622, and #5208 made cluster identity parameters (ClusterLocation, ClusterName, ClusterProjectID) optional via metadata server auto-detection, the main projectID field remained required.

Related Issue

Builds upon:

Lookup cluster workload identity from instance metadata #4575 - Lookup cluster workload identity from instance metadata
fix(gcp): makes workload identity parameters optional #4622 - Makes workload identity parameters optional (CRD updates)
docs: document redundant clusterName/clusterLocation parameters in GCP Secret Manager docs #5208 - Document redundant clusterName/clusterLocation parameters

Proposed Changes

This PR extends metadata server auto-detection to include the projectID field:

provider.go: Modified clusterProjectID() to fall back to GCP metadata server when projectID is not specified
provider.go: Modified NewClient() to populate gcpStore.ProjectID with the detected value when empty
workload_identity_test.go: Added TestClusterProjectIDMetadataFallback to verify metadata server fallback
docs: Updated google-secrets-manager.md to document the auto-detection feature with examples

Key Benefits:

Portable SecretStore configurations that work across multiple GCP projects without modification
Enables static bootstrap manifests via Config Sync/Fleet (no variable substitution needed)
Eliminates cross-cluster network dependencies for private GKE clusters
Maintains backward compatibility - projectID can still be explicitly set

Use Cases:

Multi-project GitOps deployments with shared SecretStore configs
Bootstrap scenarios where secrets are in the same project as the cluster
Simplifies configuration in environments with many clusters

Note: projectID remains required when:

Using static service account credentials (not Workload Identity)
Running outside GKE
Accessing secrets in a different GCP project than the cluster

Format

Title follows the required format: feat(gcpsm): auto-detect projectID from GCP metadata server

Checklist

I have read the contribution guidelines
All commits are signed with git commit --signoff
My changes have reasonable test coverage (added TestClusterProjectIDMetadataFallback)
All tests pass with make test (verified locally)
I ensured my PR is ready for review with make reviewable (lint and tests passed, docs build has local env issues but code is correct)

This PR adds auto-detection of GCP projectID from the GCP metadata server for SecretStore/ClusterSecretStore when using Workload Identity (and related ADC/Federation flows) on GKE, allowing projectID to be omitted when secrets live in the same GCP project as the cluster.

Changes:

providers/v1/gcp/secretmanager/provider.go
- clusterProjectID(ctx, spec) now accepts context, prefers explicit values (workloadIdentity.clusterProjectID or spec.projectID), errors when static credentials (SecretRef) are used, and otherwise falls back to the GCP metadata server.
- NewClient() populates gcpStore.ProjectID with the detected cluster projectID when projectID is empty.
- Adds metadataClientFactory = newMetadataClient to enable injection/mocking of metadata clients for tests.
- Extracts newSMClient(ctx, ts, location) to centralize Secret Manager client creation.
- Adds debug-level (V1) logging when metadata-server fallback fails to aid diagnosability.
providers/v1/gcp/secretmanager/provider_test.go
- New comprehensive unit tests covering projectID resolution and metadata fallback across auth methods (Workload Identity, Workload Identity Federation, ADC, static creds), cross-project cases, and error paths using a fake metadata client.
providers/v1/gcp/secretmanager/workload_identity_test.go
- Tests updated to pass context to clusterProjectID; adds TestClusterProjectIDMetadataFallback.
docs/provider/google-secrets-manager.md
- Documents auto-detection behavior, clarifies when projectID is required vs optional, distinguishes projectID vs clusterProjectID, adds YAML examples and verification snippets, and documents explicit cluster name/location usage.

Benefits:

Enables portable, GitOps-friendly SecretStore manifests and bootstrap scenarios where secrets are in the same project as the GKE cluster.
Reduces cross-cluster network dependencies for private GKE clusters.
Backward compatible: explicit projectID still required for static credentials, non-GKE environments, or cross-project secret access.

Notes:

projectID remains required for static service account credentials, when running outside GKE, or when accessing secrets in a different GCP project.
Tests and docs updated; contribution checklist items completed by the author.

coderabbitai · 2026-02-03T12:45:29Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

Walkthrough

Adds metadata-server fallback so SecretStore/ClusterSecretStore can omit GCP projectID on GKE, changes clusterProjectID to accept a context, introduces a metadata client factory for testing, centralizes Secret Manager client creation, expands unit tests for projectID resolution, and updates docs with auto-detection and Workload Identity guidance.

Changes

Cohort / File(s)	Summary
Documentation `docs/provider/google-secrets-manager.md`	Updates guidance and examples: `projectID` may be omitted when auto-detected from GKE metadata (WIF/WIF-Fed/ADC), clarifies when `projectID` is required, explains `projectID` vs `clusterProjectID`, adds explicit cluster name/location options and revised WIF/Core Controller YAML and verification snippets.
GCP provider implementation `providers/v1/gcp/secretmanager/provider.go`, `providers/v1/gcp/secretmanager/...workload_identity.go`	Adds `metadataClientFactory` for injection, changes `clusterProjectID` to `func(ctx context.Context, spec ...)`, implements metadata-server fallback to populate `ProjectID` when appropriate, introduces `newSMClient(ctx, ts, location)` to centralize client creation, and retains explicit errors where fallback doesn't apply.
Unit tests — workload identity `providers/v1/gcp/secretmanager/workload_identity_test.go`	Updates test call sites to pass `context.Context` to the revised `clusterProjectID` signature.
Unit tests — projectID resolution `providers/v1/gcp/secretmanager/provider_test.go`	Adds comprehensive tests using a fake metadata client covering ProjectID resolution and metadata fallback across auth methods (Workload Identity, Workload Identity Federation, ADC, static creds, AWS), cross-project and precedence scenarios, and error paths.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

coderabbitai

Actionable comments posted: 1

🤖 Fix all issues with AI agents

In `@providers/v1/gcp/secretmanager/provider.go`:
- Around line 162-176: The clusterProjectID function currently falls back to the
GKE metadata server even when static credentials are configured; update
clusterProjectID to only call metadataClientFactory() and ProjectIDWithContext
when spec.Provider.GCPSM.Auth.SecretRef is nil (i.e., no static credential
configured). If Auth.SecretRef is present and no explicit ProjectID or
WorkloadIdentity.ClusterProjectID is set, return the errNoProjectID error
instead of using metadata; reference clusterProjectID,
spec.Provider.GCPSM.Auth.SecretRef, metadataClientFactory(),
ProjectIDWithContext(ctx), and errNoProjectID when making the change.

providers/v1/gcp/secretmanager/provider.go

docs/provider/google-secrets-manager.md

@gusfcarvalho

Addresses review comments from @coderabbitai and @gusfcarvalho on PR external-secrets#5922: 1. Security fix (CodeRabbit): Block static credentials from metadata fallback - Static credentials must explicitly specify projectID - Prevents using wrong project when service account authenticates to different project 2. Comprehensive test coverage (gusfcarvalho): Test all auth methods - Added 19 new test scenarios across all authentication methods - Tests cross-project access patterns (cluster vs secrets projects) - Tests WIF variants (K8s SA, AWS credentials, credConfig) - Tests ADC/default credentials scenarios - Tests metadata unavailable scenarios 3. Documentation improvements: - Added "Understanding projectID vs clusterProjectID" section - Clarified dual-purpose nature of projectID field - Fixed incorrect auth method references (WIF vs WI) - Added cross-project YAML examples Test organization: - Created provider_test.go for all PR-added tests (21 scenarios) - Kept TestClusterProjectID in workload_identity_test.go (pre-PR baseline) Coverage: 23 total scenarios (2 before PR + 21 in PR) - Static: 2 scenarios - Workload Identity: 10 scenarios (includes cross-project) - Workload Identity Federation: 7 scenarios - Default Credentials: 4 scenarios Co-Authored-By: Claude Sonnet 4.5 (1M context) <noreply@anthropic.com>

coderabbitai

Actionable comments posted: 1

🤖 Fix all issues with AI agents

In `@providers/v1/gcp/secretmanager/provider.go`:
- Around line 88-94: The code mutates the input spec by writing to
gcpStore.ProjectID inside NewClient; instead create a shallow copy (e.g.,
gcpStoreLocal := *gcpStore), set gcpStoreLocal.ProjectID = clusterProjectID only
when empty, and assign that copy to client.store so the original gcpStore param
is not modified; ensure any subsequent access in NewClient uses the copied
variable instead of the original gcpStore.

providers/v1/gcp/secretmanager/provider.go

@gusfcarvalho

Addresses review comments from @coderabbitai and @gusfcarvalho on PR external-secrets#5922: 1. Security fix (CodeRabbit): Block static credentials from metadata fallback - Static credentials must explicitly specify projectID - Prevents using wrong project when service account authenticates to different project 2. Comprehensive test coverage (gusfcarvalho): Test all auth methods - Added 19 new test scenarios across all authentication methods - Tests cross-project access patterns (cluster vs secrets projects) - Tests WIF variants (K8s SA, AWS credentials, credConfig) - Tests ADC/default credentials scenarios - Tests metadata unavailable scenarios 3. Documentation improvements: - Added "Understanding projectID vs clusterProjectID" section - Clarified dual-purpose nature of projectID field - Fixed incorrect auth method references (WIF vs WI) - Added cross-project YAML examples Test organization: - Created provider_test.go for all PR-added tests (21 scenarios) - Kept TestClusterProjectID in workload_identity_test.go (pre-PR baseline) Coverage: 23 total scenarios (2 before PR + 21 in PR) - Static: 2 scenarios - Workload Identity: 10 scenarios (includes cross-project) - Workload Identity Federation: 7 scenarios - Default Credentials: 4 scenarios Co-Authored-By: Claude Sonnet 4.5 (1M context) <noreply@anthropic.com> Signed-off-by: Patrick Martin <patmarti@redhat.com>

patjlm · 2026-02-11T08:07:35Z

Addressed CodeRabbit's nitpick suggestion: added debug-level logging (log.V(1).Info) when the metadata server fallback fails to retrieve projectID. This helps operators diagnose auto-detection failures (e.g., metadata server blocked by network policy or returning transient errors).

See commit d03d0db.

coderabbitai

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

providers/v1/gcp/secretmanager/provider.go (1)
137-137: ⚠️ Potential issue | 🟡 Minor

Pre-existing bug: p == nil should be g == nil.

This check validates the *Provider receiver p (which is already non-nil since ValidateStore was called on it), when it should be validating g (the *GCPSMProvider config extracted on line 136). This is not introduced by this PR, but worth fixing while you're in the file.
-	if p == nil {
+	if g == nil {

@gusfcarvalho

Addresses review comments from @coderabbitai and @gusfcarvalho on PR external-secrets#5922: 1. Security fix (CodeRabbit): Block static credentials from metadata fallback - Static credentials must explicitly specify projectID - Prevents using wrong project when service account authenticates to different project 2. Comprehensive test coverage (gusfcarvalho): Test all auth methods - Added 19 new test scenarios across all authentication methods - Tests cross-project access patterns (cluster vs secrets projects) - Tests WIF variants (K8s SA, AWS credentials, credConfig) - Tests ADC/default credentials scenarios - Tests metadata unavailable scenarios 3. Documentation improvements: - Added "Understanding projectID vs clusterProjectID" section - Clarified dual-purpose nature of projectID field - Fixed incorrect auth method references (WIF vs WI) - Added cross-project YAML examples Test organization: - Created provider_test.go for all PR-added tests (21 scenarios) - Kept TestClusterProjectID in workload_identity_test.go (pre-PR baseline) Coverage: 23 total scenarios (2 before PR + 21 in PR) - Static: 2 scenarios - Workload Identity: 10 scenarios (includes cross-project) - Workload Identity Federation: 7 scenarios - Default Credentials: 4 scenarios Co-Authored-By: Claude Sonnet 4.5 (1M context) <noreply@anthropic.com> Signed-off-by: Patrick Martin <patmarti@redhat.com>

bharath-b-rh

LGTM, except for a couple of nits.

This is outside the commit, but when going through the file, found the check here should be if g == nil { instead.

providers/v1/gcp/secretmanager/provider.go

@gusfcarvalho

Addresses review comments from @coderabbitai and @gusfcarvalho on PR external-secrets#5922: 1. Security fix (CodeRabbit): Block static credentials from metadata fallback - Static credentials must explicitly specify projectID - Prevents using wrong project when service account authenticates to different project 2. Comprehensive test coverage (gusfcarvalho): Test all auth methods - Added 19 new test scenarios across all authentication methods - Tests cross-project access patterns (cluster vs secrets projects) - Tests WIF variants (K8s SA, AWS credentials, credConfig) - Tests ADC/default credentials scenarios - Tests metadata unavailable scenarios 3. Documentation improvements: - Added "Understanding projectID vs clusterProjectID" section - Clarified dual-purpose nature of projectID field - Fixed incorrect auth method references (WIF vs WI) - Added cross-project YAML examples Test organization: - Created provider_test.go for all PR-added tests (21 scenarios) - Kept TestClusterProjectID in workload_identity_test.go (pre-PR baseline) Coverage: 23 total scenarios (2 before PR + 21 in PR) - Static: 2 scenarios - Workload Identity: 10 scenarios (includes cross-project) - Workload Identity Federation: 7 scenarios - Default Credentials: 4 scenarios Co-Authored-By: Claude Sonnet 4.5 (1M context) <noreply@anthropic.com> Signed-off-by: Patrick Martin <patmarti@redhat.com>

patjlm · 2026-03-06T09:35:03Z

LGTM, except for a couple of nits.

This is outside the commit, but when going through the file, found the check here should be if g == nil { instead.

Fixed this p==nil issue in latest commit as well

Skarlso · 2026-03-06T17:27:33Z

@patjlm Please sign your commits. :)

@gusfcarvalho

Addresses review comments from @coderabbitai and @gusfcarvalho on PR external-secrets#5922: 1. Security fix (CodeRabbit): Block static credentials from metadata fallback - Static credentials must explicitly specify projectID - Prevents using wrong project when service account authenticates to different project 2. Comprehensive test coverage (gusfcarvalho): Test all auth methods - Added 19 new test scenarios across all authentication methods - Tests cross-project access patterns (cluster vs secrets projects) - Tests WIF variants (K8s SA, AWS credentials, credConfig) - Tests ADC/default credentials scenarios - Tests metadata unavailable scenarios 3. Documentation improvements: - Added "Understanding projectID vs clusterProjectID" section - Clarified dual-purpose nature of projectID field - Fixed incorrect auth method references (WIF vs WI) - Added cross-project YAML examples Test organization: - Created provider_test.go for all PR-added tests (21 scenarios) - Kept TestClusterProjectID in workload_identity_test.go (pre-PR baseline) Coverage: 23 total scenarios (2 before PR + 21 in PR) - Static: 2 scenarios - Workload Identity: 10 scenarios (includes cross-project) - Workload Identity Federation: 7 scenarios - Default Credentials: 4 scenarios Co-Authored-By: Claude Sonnet 4.5 (1M context) <noreply@anthropic.com> Signed-off-by: Patrick Martin <patmarti@redhat.com>

patjlm · 2026-03-06T20:54:57Z

@patjlm Please sign your commits. :)

sure, done @Skarlso !

@gusfcarvalho

Addresses review comments from @coderabbitai and @gusfcarvalho on PR external-secrets#5922: 1. Security fix (CodeRabbit): Block static credentials from metadata fallback - Static credentials must explicitly specify projectID - Prevents using wrong project when service account authenticates to different project 2. Comprehensive test coverage (gusfcarvalho): Test all auth methods - Added 19 new test scenarios across all authentication methods - Tests cross-project access patterns (cluster vs secrets projects) - Tests WIF variants (K8s SA, AWS credentials, credConfig) - Tests ADC/default credentials scenarios - Tests metadata unavailable scenarios 3. Documentation improvements: - Added "Understanding projectID vs clusterProjectID" section - Clarified dual-purpose nature of projectID field - Fixed incorrect auth method references (WIF vs WI) - Added cross-project YAML examples Test organization: - Created provider_test.go for all PR-added tests (21 scenarios) - Kept TestClusterProjectID in workload_identity_test.go (pre-PR baseline) Coverage: 23 total scenarios (2 before PR + 21 in PR) - Static: 2 scenarios - Workload Identity: 10 scenarios (includes cross-project) - Workload Identity Federation: 7 scenarios - Default Credentials: 4 scenarios Co-Authored-By: Claude Sonnet 4.5 (1M context) <noreply@anthropic.com> Signed-off-by: Patrick Martin <patmarti@redhat.com>

docs/provider/google-secrets-manager.md

providers/v1/gcp/secretmanager/provider.go

providers/v1/gcp/secretmanager/workload_identity_test.go

providers/v1/gcp/secretmanager/provider_test.go

providers/v1/gcp/secretmanager/provider.go

@gusfcarvalho

Addresses review comments from @coderabbitai and @gusfcarvalho on PR external-secrets#5922: 1. Security fix (CodeRabbit): Block static credentials from metadata fallback - Static credentials must explicitly specify projectID - Prevents using wrong project when service account authenticates to different project 2. Comprehensive test coverage (gusfcarvalho): Test all auth methods - Added 19 new test scenarios across all authentication methods - Tests cross-project access patterns (cluster vs secrets projects) - Tests WIF variants (K8s SA, AWS credentials, credConfig) - Tests ADC/default credentials scenarios - Tests metadata unavailable scenarios 3. Documentation improvements: - Added "Understanding projectID vs clusterProjectID" section - Clarified dual-purpose nature of projectID field - Fixed incorrect auth method references (WIF vs WI) - Added cross-project YAML examples Test organization: - Created provider_test.go for all PR-added tests (21 scenarios) - Kept TestClusterProjectID in workload_identity_test.go (pre-PR baseline) Coverage: 23 total scenarios (2 before PR + 21 in PR) - Static: 2 scenarios - Workload Identity: 10 scenarios (includes cross-project) - Workload Identity Federation: 7 scenarios - Default Credentials: 4 scenarios Co-Authored-By: Claude Sonnet 4.5 (1M context) <noreply@anthropic.com> Signed-off-by: Patrick Martin <patmarti@redhat.com>

Skarlso · 2026-03-11T20:20:01Z

@patjlm I'm afraid, you still have three commits that are un-signed, sorry. :D You can either squash everything into one and then sign that one, or you can sign all three. :)

patjlm · 2026-03-11T20:29:35Z

@Skarlso weird, i see them all signed/verified on github... but i'll squash and rebase anyways

Skarlso · 2026-03-11T20:31:02Z

https://github.com/external-secrets/external-secrets/pull/5922/checks?check_run_id=66694567331

This is the thing you need to take care of. :)

When running in GKE with Workload Identity, Workload Identity Federation, or default credentials (ADC), the projectID field can now be omitted from SecretStore/ClusterSecretStore specs. The provider will auto-detect the GCP project ID from the metadata server. Static credentials (auth.secretRef) still require explicit projectID. Also fixes a pre-existing bug in ValidateStore where `p == nil` should have been `g == nil`, and uses DeepCopy to avoid mutating the input store spec. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Patrick Martin <patmarti@redhat.com>

Skarlso · 2026-03-11T20:33:23Z

You need a Signed-off-by: Name <email@email.com> in your commit. You can get it by using git commit -s

sonarqubecloud · 2026-03-11T20:34:11Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

patjlm · 2026-03-11T20:34:54Z

done! 😓

Skarlso · 2026-03-11T20:56:10Z

/ok-to-test sha=47eb7323e8b6244e94a97fb9db588b708b1880f1

eso-service-account-app · 2026-03-11T21:12:28Z

[Bot] - ✅ e2e for 47eb7323e8b6244e94a97fb9db588b708b1880f1 passed

…-secrets#5922) Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: AlexOQ <30403857+AlexOQ@users.noreply.github.com>

…2.2.0 (#4923) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [external-secrets/external-secrets](https://github.com/external-secrets/external-secrets) | minor | `v2.1.0` → `v2.2.0` | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/2) for more information. --- ### Release Notes <details> <summary>external-secrets/external-secrets (external-secrets/external-secrets)</summary> ### [`v2.2.0`](https://github.com/external-secrets/external-secrets/releases/tag/v2.2.0) [Compare Source](external-secrets/external-secrets@v2.1.0...v2.2.0) Image: `ghcr.io/external-secrets/external-secrets:v2.2.0` Image: `ghcr.io/external-secrets/external-secrets:v2.2.0-ubi` Image: `ghcr.io/external-secrets/external-secrets:v2.2.0-ubi-boringssl`  #### What's Changed ##### General - chore: release charts v2.1.0 by [@Skarlso](https://github.com/Skarlso) in [#6030](external-secrets/external-secrets#6030) - chore: fix the stability doc by [@Skarlso](https://github.com/Skarlso) in [#6035](external-secrets/external-secrets#6035) - fix(security): Fix vulnerabilities by [@othomann](https://github.com/othomann) in [#6052](external-secrets/external-secrets#6052) - fix(aws): sync tags and resource policy even when secret value unchanged by [@evs-secops](https://github.com/evs-secops) in [#6025](external-secrets/external-secrets#6025) - fix: publish now uses docker build v4 which required some changes by [@Skarlso](https://github.com/Skarlso) in [#6062](external-secrets/external-secrets#6062) - feat(gcpsm): auto-detect projectID from GCP metadata server by [@patjlm](https://github.com/patjlm) in [#5922](external-secrets/external-secrets#5922) - chore(templating): Remove years in license and their checks by [@evrardj-roche](https://github.com/evrardj-roche) in [#5955](external-secrets/external-secrets#5955) - docs: Add Roche to official ADOPTERS by [@evrardj-roche](https://github.com/evrardj-roche) in [#6076](external-secrets/external-secrets#6076) - feat: Add Last Sync column to ExternalSecret and PushSecret printers by [@jaruwat-panturat](https://github.com/jaruwat-panturat) in [#6068](external-secrets/external-secrets#6068) - fix(onepassword): support native item IDs by [@chadxz](https://github.com/chadxz) in [#6073](external-secrets/external-secrets#6073) - feat: extract LGTM processor to external JS file with tests by [@mateenali66](https://github.com/mateenali66) in [#6074](external-secrets/external-secrets#6074) - feat: fail fast if LGTM label does not exist in repository by [@mateenali66](https://github.com/mateenali66) in [#6078](external-secrets/external-secrets#6078) - feat(passbolt): add support for Passbolt V5 API by [@cedricherzog-passbolt](https://github.com/cedricherzog-passbolt) in [#5919](external-secrets/external-secrets#5919) - fix(infisical): dataFrom.find.path should filter by secret path not name by [@johnvox](https://github.com/johnvox) in [#6086](external-secrets/external-secrets#6086) - fix: disable the priority queue which misbehaves at scale by [@Skarlso](https://github.com/Skarlso) in [#6083](external-secrets/external-secrets#6083) - chore: update go version to 1.26.1 by [@Skarlso](https://github.com/Skarlso) in [#6072](external-secrets/external-secrets#6072) - docs(aws): fix PushSecret metadata indentation in resource policy exa... by [@Br1an67](https://github.com/Br1an67) in [#6056](external-secrets/external-secrets#6056) - fix(aws): prevent EC2 IMDS fallback when explicit credentials are pro... by [@Br1an67](https://github.com/Br1an67) in [#6036](external-secrets/external-secrets#6036) - feat(templating): Add certSANs function to extract SANs from certificates by [@mzdeb](https://github.com/mzdeb) in [#6058](external-secrets/external-secrets#6058) - docs: document template.metadata labels/annotations behavior by [@lucpas](https://github.com/lucpas) in [#6102](external-secrets/external-secrets#6102) - fix: CODEOWNERS are seriously out of date by [@Skarlso](https://github.com/Skarlso) in [#6106](external-secrets/external-secrets#6106) - feat(helm): add readinessProbe support for external-secrets deployment by [@AlexOQ](https://github.com/AlexOQ) in [#5831](external-secrets/external-secrets#5831) - fix: update grpc for CVE-2026-33186 by [@Skarlso](https://github.com/Skarlso) in [#6108](external-secrets/external-secrets#6108) - feat(azurekv): add expiration time to azure kv secret by [@muraliavarma](https://github.com/muraliavarma) in [#5935](external-secrets/external-secrets#5935) - feat: add path to cloud.ru provider by [@heavyandrew](https://github.com/heavyandrew) in [#5952](external-secrets/external-secrets#5952) - fix(add-eso-version): fix separator line pattern in add\_eso\_version.sh script by [@riccardomc](https://github.com/riccardomc) in [#6113](external-secrets/external-secrets#6113) ##### Dependencies - chore(deps): bump zizmorcore/zizmor-action from 0.5.0 to 0.5.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#6038](external-secrets/external-secrets#6038) - chore(deps): bump charset-normalizer from 3.4.4 to 3.4.5 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6047](external-secrets/external-secrets#6047) - chore(deps): bump platformdirs from 4.9.2 to 4.9.4 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6050](external-secrets/external-secrets#6050) - chore(deps): bump mkdocs-material from 9.7.3 to 9.7.4 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6049](external-secrets/external-secrets#6049) - chore(deps): bump github/codeql-action from 4.32.4 to 4.32.6 by [@dependabot](https://github.com/dependabot)\[bot] in [#6039](external-secrets/external-secrets#6039) - chore(deps): bump step-security/harden-runner from 2.15.0 to 2.15.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#6043](external-secrets/external-secrets#6043) - chore(deps): bump actions/dependency-review-action from 4.8.3 to 4.9.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6040](external-secrets/external-secrets#6040) - chore(deps): bump crazy-max/ghaction-import-gpg from 6.3.0 to 7.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6044](external-secrets/external-secrets#6044) - chore(deps): bump docker/login-action from 3.7.0 to 4.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6042](external-secrets/external-secrets#6042) - chore(deps): bump docker/setup-buildx-action from 3.12.0 to 4.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6041](external-secrets/external-secrets#6041) - chore(deps): bump docker/setup-qemu-action from 3.7.0 to 4.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6046](external-secrets/external-secrets#6046) - chore(deps): bump aquasecurity/trivy-action from 0.34.1 to 0.35.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6048](external-secrets/external-secrets#6048) - chore(deps): bump anchore/sbom-action from 0.23.0 to 0.23.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#6093](external-secrets/external-secrets#6093) - chore(deps): bump distroless/static from `28efbe9` to `47b2d72` by [@dependabot](https://github.com/dependabot)\[bot] in [#6088](external-secrets/external-secrets#6088) - chore(deps): bump ubi9/ubi from `cecb1cd` to `6ed9f6f` by [@dependabot](https://github.com/dependabot)\[bot] in [#6087](external-secrets/external-secrets#6087) - chore(deps): bump mkdocs-material from 9.7.4 to 9.7.5 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6096](external-secrets/external-secrets#6096) - chore(deps): bump tornado from 6.5.4 to 6.5.5 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6094](external-secrets/external-secrets#6094) - chore(deps): bump charset-normalizer from 3.4.5 to 3.4.6 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6095](external-secrets/external-secrets#6095) - chore(deps): bump step-security/harden-runner from 2.15.1 to 2.16.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6089](external-secrets/external-secrets#6089) - chore(deps): bump sigstore/cosign-installer from 4.0.0 to 4.1.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6092](external-secrets/external-secrets#6092) - chore(deps): bump softprops/action-gh-release from 2.5.0 to 2.6.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#6090](external-secrets/external-secrets#6090) - chore(deps): bump actions/create-github-app-token from 2.2.1 to 3.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6091](external-secrets/external-secrets#6091) #### New Contributors - [@othomann](https://github.com/othomann) made their first contribution in [#6052](external-secrets/external-secrets#6052) - [@evs-secops](https://github.com/evs-secops) made their first contribution in [#6025](external-secrets/external-secrets#6025) - [@patjlm](https://github.com/patjlm) made their first contribution in [#5922](external-secrets/external-secrets#5922) - [@jaruwat-panturat](https://github.com/jaruwat-panturat) made their first contribution in [#6068](external-secrets/external-secrets#6068) - [@chadxz](https://github.com/chadxz) made their first contribution in [#6073](external-secrets/external-secrets#6073) - [@mateenali66](https://github.com/mateenali66) made their first contribution in [#6074](external-secrets/external-secrets#6074) - [@cedricherzog-passbolt](https://github.com/cedricherzog-passbolt) made their first contribution in [#5919](external-secrets/external-secrets#5919) - [@johnvox](https://github.com/johnvox) made their first contribution in [#6086](external-secrets/external-secrets#6086) - [@Br1an67](https://github.com/Br1an67) made their first contribution in [#6056](external-secrets/external-secrets#6056) - [@mzdeb](https://github.com/mzdeb) made their first contribution in [#6058](external-secrets/external-secrets#6058) - [@lucpas](https://github.com/lucpas) made their first contribution in [#6102](external-secrets/external-secrets#6102) - [@AlexOQ](https://github.com/AlexOQ) made their first contribution in [#5831](external-secrets/external-secrets#5831) - [@muraliavarma](https://github.com/muraliavarma) made their first contribution in [#5935](external-secrets/external-secrets#5935) - [@heavyandrew](https://github.com/heavyandrew) made their first contribution in [#5952](external-secrets/external-secrets#5952) **Full Changelog**: <external-secrets/external-secrets@v2.1.0...v2.2.0> </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/4923 Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net> Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [external-secrets](https://github.com/external-secrets/external-secrets) | minor | `2.1.0` → `2.2.0` | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/2) for more information. --- ### Release Notes <details> <summary>external-secrets/external-secrets (external-secrets)</summary> ### [`v2.2.0`](https://github.com/external-secrets/external-secrets/releases/tag/v2.2.0) [Compare Source](external-secrets/external-secrets@v2.1.0...v2.2.0) Image: `ghcr.io/external-secrets/external-secrets:v2.2.0` Image: `ghcr.io/external-secrets/external-secrets:v2.2.0-ubi` Image: `ghcr.io/external-secrets/external-secrets:v2.2.0-ubi-boringssl`  ##### What's Changed ##### General - chore: release charts v2.1.0 by [@Skarlso](https://github.com/Skarlso) in [#6030](external-secrets/external-secrets#6030) - chore: fix the stability doc by [@Skarlso](https://github.com/Skarlso) in [#6035](external-secrets/external-secrets#6035) - fix(security): Fix vulnerabilities by [@othomann](https://github.com/othomann) in [#6052](external-secrets/external-secrets#6052) - fix(aws): sync tags and resource policy even when secret value unchanged by [@evs-secops](https://github.com/evs-secops) in [#6025](external-secrets/external-secrets#6025) - fix: publish now uses docker build v4 which required some changes by [@Skarlso](https://github.com/Skarlso) in [#6062](external-secrets/external-secrets#6062) - feat(gcpsm): auto-detect projectID from GCP metadata server by [@patjlm](https://github.com/patjlm) in [#5922](external-secrets/external-secrets#5922) - chore(templating): Remove years in license and their checks by [@evrardj-roche](https://github.com/evrardj-roche) in [#5955](external-secrets/external-secrets#5955) - docs: Add Roche to official ADOPTERS by [@evrardj-roche](https://github.com/evrardj-roche) in [#6076](external-secrets/external-secrets#6076) - feat: Add Last Sync column to ExternalSecret and PushSecret printers by [@jaruwat-panturat](https://github.com/jaruwat-panturat) in [#6068](external-secrets/external-secrets#6068) - fix(onepassword): support native item IDs by [@chadxz](https://github.com/chadxz) in [#6073](external-secrets/external-secrets#6073) - feat: extract LGTM processor to external JS file with tests by [@mateenali66](https://github.com/mateenali66) in [#6074](external-secrets/external-secrets#6074) - feat: fail fast if LGTM label does not exist in repository by [@mateenali66](https://github.com/mateenali66) in [#6078](external-secrets/external-secrets#6078) - feat(passbolt): add support for Passbolt V5 API by [@cedricherzog-passbolt](https://github.com/cedricherzog-passbolt) in [#5919](external-secrets/external-secrets#5919) - fix(infisical): dataFrom.find.path should filter by secret path not name by [@johnvox](https://github.com/johnvox) in [#6086](external-secrets/external-secrets#6086) - fix: disable the priority queue which misbehaves at scale by [@Skarlso](https://github.com/Skarlso) in [#6083](external-secrets/external-secrets#6083) - chore: update go version to 1.26.1 by [@Skarlso](https://github.com/Skarlso) in [#6072](external-secrets/external-secrets#6072) - docs(aws): fix PushSecret metadata indentation in resource policy exa... by [@Br1an67](https://github.com/Br1an67) in [#6056](external-secrets/external-secrets#6056) - fix(aws): prevent EC2 IMDS fallback when explicit credentials are pro... by [@Br1an67](https://github.com/Br1an67) in [#6036](external-secrets/external-secrets#6036) - feat(templating): Add certSANs function to extract SANs from certificates by [@mzdeb](https://github.com/mzdeb) in [#6058](external-secrets/external-secrets#6058) - docs: document template.metadata labels/annotations behavior by [@lucpas](https://github.com/lucpas) in [#6102](external-secrets/external-secrets#6102) - fix: CODEOWNERS are seriously out of date by [@Skarlso](https://github.com/Skarlso) in [#6106](external-secrets/external-secrets#6106) - feat(helm): add readinessProbe support for external-secrets deployment by [@AlexOQ](https://github.com/AlexOQ) in [#5831](external-secrets/external-secrets#5831) - fix: update grpc for CVE-2026-33186 by [@Skarlso](https://github.com/Skarlso) in [#6108](external-secrets/external-secrets#6108) - feat(azurekv): add expiration time to azure kv secret by [@muraliavarma](https://github.com/muraliavarma) in [#5935](external-secrets/external-secrets#5935) - feat: add path to cloud.ru provider by [@heavyandrew](https://github.com/heavyandrew) in [#5952](external-secrets/external-secrets#5952) - fix(add-eso-version): fix separator line pattern in add\_eso\_version.sh script by [@riccardomc](https://github.com/riccardomc) in [#6113](external-secrets/external-secrets#6113) ##### Dependencies - chore(deps): bump zizmorcore/zizmor-action from 0.5.0 to 0.5.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#6038](external-secrets/external-secrets#6038) - chore(deps): bump charset-normalizer from 3.4.4 to 3.4.5 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6047](external-secrets/external-secrets#6047) - chore(deps): bump platformdirs from 4.9.2 to 4.9.4 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6050](external-secrets/external-secrets#6050) - chore(deps): bump mkdocs-material from 9.7.3 to 9.7.4 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6049](external-secrets/external-secrets#6049) - chore(deps): bump github/codeql-action from 4.32.4 to 4.32.6 by [@dependabot](https://github.com/dependabot)\[bot] in [#6039](external-secrets/external-secrets#6039) - chore(deps): bump step-security/harden-runner from 2.15.0 to 2.15.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#6043](external-secrets/external-secrets#6043) - chore(deps): bump actions/dependency-review-action from 4.8.3 to 4.9.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6040](external-secrets/external-secrets#6040) - chore(deps): bump crazy-max/ghaction-import-gpg from 6.3.0 to 7.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6044](external-secrets/external-secrets#6044) - chore(deps): bump docker/login-action from 3.7.0 to 4.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6042](external-secrets/external-secrets#6042) - chore(deps): bump docker/setup-buildx-action from 3.12.0 to 4.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6041](external-secrets/external-secrets#6041) - chore(deps): bump docker/setup-qemu-action from 3.7.0 to 4.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6046](external-secrets/external-secrets#6046) - chore(deps): bump aquasecurity/trivy-action from 0.34.1 to 0.35.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6048](external-secrets/external-secrets#6048) - chore(deps): bump anchore/sbom-action from 0.23.0 to 0.23.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#6093](external-secrets/external-secrets#6093) - chore(deps): bump distroless/static from `28efbe9` to `47b2d72` by [@dependabot](https://github.com/dependabot)\[bot] in [#6088](external-secrets/external-secrets#6088) - chore(deps): bump ubi9/ubi from `cecb1cd` to `6ed9f6f` by [@dependabot](https://github.com/dependabot)\[bot] in [#6087](external-secrets/external-secrets#6087) - chore(deps): bump mkdocs-material from 9.7.4 to 9.7.5 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6096](external-secrets/external-secrets#6096) - chore(deps): bump tornado from 6.5.4 to 6.5.5 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6094](external-secrets/external-secrets#6094) - chore(deps): bump charset-normalizer from 3.4.5 to 3.4.6 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#6095](external-secrets/external-secrets#6095) - chore(deps): bump step-security/harden-runner from 2.15.1 to 2.16.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6089](external-secrets/external-secrets#6089) - chore(deps): bump sigstore/cosign-installer from 4.0.0 to 4.1.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6092](external-secrets/external-secrets#6092) - chore(deps): bump softprops/action-gh-release from 2.5.0 to 2.6.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#6090](external-secrets/external-secrets#6090) - chore(deps): bump actions/create-github-app-token from 2.2.1 to 3.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#6091](external-secrets/external-secrets#6091) ##### New Contributors - [@othomann](https://github.com/othomann) made their first contribution in [#6052](external-secrets/external-secrets#6052) - [@evs-secops](https://github.com/evs-secops) made their first contribution in [#6025](external-secrets/external-secrets#6025) - [@patjlm](https://github.com/patjlm) made their first contribution in [#5922](external-secrets/external-secrets#5922) - [@jaruwat-panturat](https://github.com/jaruwat-panturat) made their first contribution in [#6068](external-secrets/external-secrets#6068) - [@chadxz](https://github.com/chadxz) made their first contribution in [#6073](external-secrets/external-secrets#6073) - [@mateenali66](https://github.com/mateenali66) made their first contribution in [#6074](external-secrets/external-secrets#6074) - [@cedricherzog-passbolt](https://github.com/cedricherzog-passbolt) made their first contribution in [#5919](external-secrets/external-secrets#5919) - [@johnvox](https://github.com/johnvox) made their first contribution in [#6086](external-secrets/external-secrets#6086) - [@Br1an67](https://github.com/Br1an67) made their first contribution in [#6056](external-secrets/external-secrets#6056) - [@mzdeb](https://github.com/mzdeb) made their first contribution in [#6058](external-secrets/external-secrets#6058) - [@lucpas](https://github.com/lucpas) made their first contribution in [#6102](external-secrets/external-secrets#6102) - [@AlexOQ](https://github.com/AlexOQ) made their first contribution in [#5831](external-secrets/external-secrets#5831) - [@muraliavarma](https://github.com/muraliavarma) made their first contribution in [#5935](external-secrets/external-secrets#5935) - [@heavyandrew](https://github.com/heavyandrew) made their first contribution in [#5952](external-secrets/external-secrets#5952) **Full Changelog**: <external-secrets/external-secrets@v2.1.0...v2.2.0> </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/4927 Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net> Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>

…-secrets#5922) Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Bump External Secrets from v1.3.1 to v2.2.0, which includes the upstream projectID auto-detection feature (external-secrets/external-secrets#5922). Remove the temporary quay.io/patmarti/external-secrets image override that was used to test this fix before the official release. Ref: GCP-512 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

github-project-automation bot added this to External Secrets Feb 3, 2026

github-actions bot added area/gcpsm kind/feature Categorizes issue or PR as related to a new feature. kind/documentation Categorizes issue or PR as related to documentation. size/m labels Feb 3, 2026

coderabbitai bot reviewed Feb 3, 2026

View reviewed changes

providers/v1/gcp/secretmanager/provider.go Show resolved Hide resolved

gusfcarvalho reviewed Feb 3, 2026

View reviewed changes

docs/provider/google-secrets-manager.md Outdated Show resolved Hide resolved

github-actions bot added the size/l label Feb 4, 2026

coderabbitai bot reviewed Feb 4, 2026

View reviewed changes

providers/v1/gcp/secretmanager/provider.go Show resolved Hide resolved

patjlm force-pushed the gcpsm-projectid-metadata-fallback branch from 4297944 to cd938fb Compare February 9, 2026 20:09

coderabbitai bot reviewed Feb 11, 2026

View reviewed changes

patjlm force-pushed the gcpsm-projectid-metadata-fallback branch from d03d0db to fcc0eb8 Compare February 11, 2026 08:38

patjlm force-pushed the gcpsm-projectid-metadata-fallback branch from fcc0eb8 to aeb45b7 Compare March 4, 2026 09:25

bharath-b-rh reviewed Mar 6, 2026

View reviewed changes

providers/v1/gcp/secretmanager/provider.go Show resolved Hide resolved

patjlm force-pushed the gcpsm-projectid-metadata-fallback branch from aeb45b7 to dded5db Compare March 6, 2026 09:33

bharath-b-rh approved these changes Mar 6, 2026

View reviewed changes

patjlm force-pushed the gcpsm-projectid-metadata-fallback branch from dded5db to 6c04b61 Compare March 6, 2026 20:53

patjlm force-pushed the gcpsm-projectid-metadata-fallback branch from 6c04b61 to 45c225e Compare March 6, 2026 20:55